sundsta
07/22/2019, 5:15 PMzwass
sundsta
07/22/2019, 5:17 PMSELECT * FROM file_events LIMIT 10
and SELECT * FROM process_events LIMIT 10
zwass
file_events
requires that you configure the watch paths. Did you do that?sundsta
07/22/2019, 5:22 PMzwass
process_events
needs additional configuration (outside of osquery) as well. See https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#macos-process-auditingdisk_events
(try opening a dmg) or hardware_events
(plug any usb device)sundsta
07/22/2019, 5:27 PMprocess_events
, even after modifying the audit config and a rebootosqueryi
if that matters at allzwass